General information
The new "Account Linking Suggestions" program feature was developed to allow Maltego Evidence to independently identify profiles of the same person and mark them as potential account links. This feature provides an efficient way to identify and manage duplicates or different accounts of the same user.
The detection logic has been designed in a modular way to allow the seamless integration of new detection factors. This allows the system to remain flexible and adapt to changing requirements and environments.
In addition, the Linking Manager provides a user-friendly interface through which the user can manage all recognized potential account links. This central interface allows the user to merge or separate accounts to optimize account management.
The implementation of the "Account Linkings" program feature significantly improves the efficiency and usability of Maltego Evidence by eliminating redundant accounts and optimizing the management of user profiles.
Recognition logic
The implementation initially enables the recognition of account links based on the data of a single profile. These are in particular:
- User ID
- User ID number
- user name
Factors for recognizing similar profiles can include:
- Same username
Similar username - similar spellings or general similarity of words are taken into account
Examples:
"Michael Mustermann" -> "Michael Muster" "Michael Mustermann" -> "Michael Musterman" - Components of the user name in the user ID
Examples:
"Michael Mustermann" -> michael.mustermann.234 "Michael Mustermann" -> MichaelMustermann234 - Components of the user name are also similar in the user ID
Examples:
"Michael Mustermann" -> michael.muster.234 "Michael Mustermann" -> MichaelMuster234
Detection accuracy
Each detection is assigned a probability (0% to 100%).
For better usability, Maltego Evidence offers a filter of account linking suggestions in three modes
Mode "Conservative"
The "Conservative" mode displays account linkings with an accuracy of between 85% and 100%.
Mode "Normal"
The "Normal" mode displays account linkings whose accuracy is between 65% and 85%. In addition, all hits in "Conservative" mode are also displayed.
Mode "Creative"
The "Creative" mode displays account linkings whose accuracy is below 65%. In addition, all hits from the "Conservative" and "Normal" modes are also displayed.
Confirm account linkings
The automatic detection of account linkings is an algorithm-based automatic suggestion function. Therefore, the detected suggestions are not applied automatically. Each suggestion must be checked and confirmed manually.
You can tell whether account linking suggestions are available in your project by the account linking icon in the project system bar. The numerical value of the badge contains the number of account linkings detected, depending on the selected mode.
To open the Account Linking Manager, click on this icon.
Alternatively, each account that is opened in the right-hand data panel also shows whether an account linking has been detected for this account.
The Link Manager consists of two areas. In the left panel, you can set the account linking mode and filter the detected account linkings.
The table on the right shows you the account linkings detected
Mode selection
Click on "Conservative", "Normal" or "Creative" to set the accuracy of the displayed account linkings.
Account linking table
All account linkings corresponding to the mode are displayed in the account linking table. Each presumably related account linking is framed in gray.
To confirm an account linking, please mark the checkbox in front of each account that you want to add to an account linking and click on "Apply". With the upper checkbox you can select all accounts at the same time.
After confirming the account linkings, they will be displayed in the data explorer in the same way as the manual account linkings.
If the account linking proposal is not correct, you can discard it. To do this, select the checkbox in front of each account whose suggestion you want to discard and click on "Don't show again".
If you want to confirm several account linking proposals at the same time, select all the relevant accounts and click on "Apply all selected".
Existing projects
With the introduction of account linking suggestions, an automatic comparison is carried out in all new projects after each new data collection and account linking suggestions are identified.
This function must first be set for existing projects.
- Open the project in question from your project list.
- Open the project settings
- Scroll down to the sub-item "Account Linking Suggestions"
- Move the slider to "Enabled" and click on "Calculate".
The calculation may take a few seconds, depending on the number of profiles in the project.
